EP1665001B1

EP1665001B1 - Method for detecting and reacting against possible attack to security enforcing operation performed by a cryptographic token or card

Info

Publication number: EP1665001B1
Application number: EP05763311A
Authority: EP
Inventors: Paolo Di Iorio
Original assignee: Incard SA
Current assignee: Incard SA
Priority date: 2004-06-30
Filing date: 2005-06-30
Publication date: 2008-03-19
Anticipated expiration: 2025-06-30
Also published as: CN101031857A; CN100535822C; EP1665001A2; US8566927B2; ATE389917T1; WO2006002926A2; EP1612639A1; DE602005005422D1; BRPI0512912A; WO2006002926A3; US20080209550A1; DE602005005422T2

Abstract

The invention define a new protection mechanism against attacks to security enforcing operation performed by cryptographic token and smart card. It is based on an attack detector which signal to the main elaboration system a potential attack situation. The invention offer an easy solution to SIM cloning problems of telecom operators which use old and breakable cryptographic algorithms such as the COMP-128 and does not want to invest many in updating the network authentication systems with more resistant authentication cryptographic algorithms. This is requirement is typical of the telecom operator of the emerging market which use not the state of the art in technology.

Description

FIELD OF APPLICATION

This invention relates to a method for detecting and reacting against possible attacks to security enforcing operation performed by a cryptographic token or IC card.
The invention further relates to a token or IC card structured for implementing the above method and including means for detecting and reacting against possible attacks to security enforcing operations and comprising a microcontroller with associated or embedded memory portions.

BACKGROUND OF THE INVENTION

As is well known in this specific technical field secure tokens are available as integrated circuit cards incorporating a security software and specifically designed to retain secret data and information. Secure tokens can also have programmable language, such as Java, enabling them to run applications.
Secure or cryptographic tokens or cards include a protected storage area and a non-protected storage area. The protected area can only be accessed using a pin code created at the secure token creation, but that can be changed by the user.
The cryptographic token is normally used to store a secret key and to calculate a cryptographic algorithm using such a secret key on some input data that are received from an outside source.
The result of the calculation is sent back to the outside source (external word) that uses such a calculation for completing an authentication procedure.
As may be clearly understood, the authentication procedure is a weakness of the security relating to cryptographic tokens or cards since a tampering attack may be performed just during this procedure to access the secret information stored in the token or card. The prior art already provides for anti-tampering methods for reacting against possible attacks to cryptographic token and smart card storing secret information such as the secret keys used by the token in the security operation, lots of techniques has been developed and patented.
The prior art techniques focus the attention on countermeasures against power analysis and electromagnetic analysis attacks trying to make harder an attack based on analysis of the power and/or the electromagnetic emission during the manipulation of sensible information.
Some of the countermeasures can be implemented either in the algorithm code or at hardware level and mainly try to obscure the sensible information observable from the power traces and from the electromagnetic emissions.
Typically this countermeasures consists in adding noise on the power absorbed by the card or introducing random delay in the code execution. The random delay reduce the correlation between different traces and make harder the attack.
Other countermeasures to counteract such attacks are based on the masking of the sensible information during the elaboration by means of random transformation.
However, these techniques are specifically designed for protecting the implementation of the algorithm but they do not give any protection to the logic on which the algorithm is founded. In other words, no matter how good and complex the algorithm may be, but it becomes weak with the time as the computation power available to attacker increases and the algorithm become well known and studied by the attackers.
Moreover, the countermeasures against power and electromagnetic analysis implemented in the algorithm code are often implementation dependent and cannot be applied to all cryptographic algorithm in the same manner.
Another countermeasure trying to reduce the risks of attacks to cryptographic token or Smart Card is known as authentication Counter.
An authentication counter tries to limit the number of security enforcing procedure that the system can perform in all the system life. It address both attacks oriented to break the cryptographic logical and mathematics and attacks mining the implementation.
However, this countermeasure is no more effective in many cases since the number of executions of security procedure to break the system is typically minor than the total number of execution in all the lifecycle of the system.
A further solution is disclosed in the US patent No. 4,879,645 relating to a data processing device with high security of stored programs.
This document teaches to detect an input command for the cryptographic token or card and to count the number of times this input command is executed; however, this document does not take in consideration the possibility to assign a ponder value to such an input command.
Other techniques to increase the security procedure are based on the use of session keys evaluated each time a cryptographic elaboration is required.
Even if this technique may be considered more efficient if compared to the previously cited prior art techniques, it is pretty complex to be implemented and this is due on the fact that the cryptographic token and the other primary circuit portions involved in the security operation store not only a common master key but also a common state should be used to elaborate the session keys that have to always be synchronized.
The technical problem of the present invention is that of providing an efficient method for detecting and reacting against possible attacks to security enforcing operation performed by a cryptographic token or a smart card having features allowing to be independent from the implementation and assuring protection to the logic on which the algorithm is founded, not only to its implementation.
Another aim of the present invention is that of protecting authentication procedures based on cryptographic operation in which the authentication response is performed outside the cryptographic token.
Still another aim of the present invention is that of enforcing security operation regarding cryptographic token meanwhile maintaining a certain reasonable level of complexity.
A further aim of the invention is that of providing a method capable to react against possible attacks guaranteeing security without considering a static threshold to the number of sensible operations in the lifecycle of the system. The method should preserve its safety even if the number of executions of security procedure to break the system is minor then a threshold depending on improvement of the techniques implemented by the attackers.
A further aim of the present invention is that of providing a method capable to detect a potential attack to security enforcing operation in a dynamic and implementation independent way.

SUMMARY OF THE INVENTION

The solution idea on which the invention is based is that of providing the token or card with an attack detector capable to issue a signal to the main elaboration system informing about a potential attack situation.
An first embodiment of this invention provides a method for including the following steps:

detecting an input command for the cryptographic token;
assigning a ponder value to such an input command;
updating a counter value;
comparing said counter value with a reference threshold;
providing a warning signal output according to the result of the comparing phase;
wherein said counter value changes dynamically depending on the sequence of execution of said input commands, the counter value being updated according to the ponder values associated to the executed input commands.
Another embodiment of the invention provides for a token an IC card or an electronic embedded system structured to implement the inventive method and including means for detecting and reacting against possible attacks to security enforcing operations and comprising a microcontroller with associated or embedded memory portions, characterized in that said means include an attack detector comprising a ponder over for assigning a ponder value to an input command of the token or card, a counter connected to the output ponder over for storing a counter value, a threshold reference to define a comparison value and a comparator to compare said counter value with said threshold value and provide an output warning signal according to the result of the comparison.
The features and advantages of the method and IC card according to the present invention will become apparent from the following description of an embodiment thereof, given by way of non-limiting example with reference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWING

Figure 1 is a schematic and simplified view showing a cryptographic token or a smart card system equipped with an attack detector based on the method of the present invention;
Figure 2 is a more detailed and schematic view of a portion of the system of Figure 1;
Figure 3 is a flow chart showing the steps of the method according to the present invention.

DETAILED DESCRIPTION

With reference to the drawings figure a cryptographic token or IC card system realized according to the present invention is globally and schematically shown with the numeral reference 1.
The IC card to be used for a plug-in insertion into a host electronic device, not shown being of a conventional type such as for instance a mobile telephone device.
The IC card 1 may have the format and the external shape of a common SIM card for mobile telephonic application. However, nothing prevents from having the card 1 structured according to a different shape or format required by a specific application.
The IC card 1 includes a microcontroller 2, that may be considered the main processing unit, and conventional memory portions which are strictly associated to the microcontroller 2.
For the purpose of the present invention the quality and composition of the memory portions associated to the microcontroller 2 is not relevant. However, in order to provide a complete description of the system we may be considered that the token or card 1 is an integrated or embedded system equipped with a first read-only memory portion, a second or extended non-volatile memory portion and at least a further memory portion.
The first memory portion is generally a ROM memory including programs, i.e. software applications, masked on the read-only memory and defining the functionalities of the card.
Said second and extended memory portion is a non volatile memory may be an electrically erasable memory portion of the EEPROM or Flash having a NOR structure and including subroutines, extended instructions and or customised data.
Said further memory portion may be structurally and functionally independent from both said first read only memory portion and said extended memory portion and may be a read/write memory such as a volatile RAM.
As an alternative, even said further memory portion may be a EEPROM or another non-volatile memory device.
Advantageously, according to the present invention, the token or card 1 includes an attack detector 3 that may be structured as an hardware circuit portion or a software algorithm stored in one of the above mentioned memory portions.
More particularly, the attack detector 3 is involved in the cryptographic operations of the token 1 and includes an interface 4 used to receive input commands (b) and an output interface 5 for providing output signals (c) as a response.
The attack detector 3 comprises the following macro components:

a Ponder Over 6 receiving said input commands and assigning a ponder value to each input command;
a Counter 7 connected to the output of ponder over 7 for incrementing or decrementing a stored counter value;
a Threshold Reference 8 defining a threshold value for a comparison phase;
a Comparator 9 for comparing the value stored in the counter 7 with the threshold value and providing an output signal rising up the output line if the counter is minor than the threshold.

More particularly the counter value doesn't relates to the execution of a specified input command but it is incremented or decremented every time that an input command is executed. In this way the reaching of the threshold reference 8 is determined by the sequence of execution of input commands; in other words the threshold reference is not strictly related to the number of times a specific input command is executed but it is determined by the contribution of all the input commands executed.The microcontroller 2, which normally process the input data and provide the output, receives the output of the comparator 9. As an alternative the Operating System of the token or card 1 receives and warning signal from a running attack detecting subroutine.
To fully understand the method of the present invention it worth while to note that the most common techniques of attack to cryptographic algorithms implemented on cryptographic token and smart card are based on the repetitive execution of the card reading algorithm in order to acquire information useful to the attacker.
Useful information could be for instance: cipher text, couple of plain/cipher text or physical greatnesses in dependence on the kind of attack.
The number of executions required to complete successfully an attack vary considerably with the algorithm, its implementation and the instrumentation or reader available to the attacker, but it is typically considerably large, over 10.000 executions.
The time between subsequent algorithm executions is also a very important factor in determining the overall complexity of an attack; in fact an attack can be conducted successfully only if it require a time judged reasonable by the attacker.
This is true both for the logical attacks such as known/chosen plain text attacks and adaptive chosen plaintext attacks and for the power analysis and electromagnetic analysis attacks.
Advantageously, the attack detector incorporated into the token or card 1 according to the present invention allows alerting the microcontroller 2 about a potential attack issuing a warning signal when the execution of the security procedures based on cryptographic algorithm are invoked too often with respect to the typical working scenario.
The method is performed according to the following steps:

detecting an input command for the cryptographic token;
assigning a ponder value to such an input command;
updating a counter value;
comparing said counter value with a reference threshold;

The system can in this way set up appropriate reactions such as:

slow down the execution of the cryptographic algorithm so to enlarge the time required for a successful attack, thus discouraging an attacker;
block the cryptographic algorithm under execution;
mute the card;
returning wrong results to confuse the attacker or other measures.

According to the inventive method, the Ponder Over 6 assign a ponder value to an input command; for instance, the ponder block 6 may be structured with a look up table including a ponder value for each different kind of input command.
Follows an example of the ponder over in the case of realization with a look up table. Let suppose that the card accepts three different APDU in input: APDU#1, ADPU#2, APDU#3. Among these APDU let suppose that the APDU#2 is relevant for security because for example trigger the execution of a cryptographic algorithm. Let also suppose that the APDU#2 is more frequent than the other APDUs. The look up table could be organized as in Table 1. The ponder value is retrieved by looking up into the Ponder Over look up table with respect to the input APDU.
The ponder values assignment strategy could be summarized in this way: ponder values have to be assigned considering the frequency of security relevant APDUs with respect to the frequency of the other APDUs in the case of normal working conditions. Ponder values have to produce a warning in the case the attack detector detects that the frequency of the security relevant APDUs with respect to the other APDU exceed the frequency in the case of normal working conditions. Ponder values for security relevant APDUs should have a positive value; ponder values for not security relevant APDUs should have a negative value. Moreover the ponder value should be inversely proportional to APDUs frequency: the more an APDU is issued frequently in the normal working condition the lower should be its ponder. Table 1 - Ponder Over Table

APDU Ponder Value Note:

APDU#1 -02 Not Security Relevant very frequent APDU

APDU#

2 10 Security Relevant APDU

APDU#3 -04 Not Security Relevant but not very frequent APDU

Let consider the ponder over implemented by means of the look up table of Table 1. Let suppose that the sequence of APDUs in the normal working condition is the following: APDU#3, APDU#1, APDU#1, APDU#1, APDU#2; let also suppose that the counter have an initial value of 20 and the threshold level is set to 25. Table 2, Table 3 sketches the way of working of the ponder over.

Table 2 - Normal working sequence; no warning is raised up by the attack detector

Input APDU	Ponder Value	Counter Value (old + ponder = new value)	Threshold	Warning Status
APDU#3	-4	20 - 5 = 16	25	No warn
APDU#1	-2	16 - 2 = 14	25	No warn
APDU#1	-2	14 - 2 = 12	25	No warn
APDU#1	-2	12 - 2 = 10	25	No warn
APDU#2	+10	10 + 10 = 20	25	No warn
APDU#3	-4	20 - 4 = 16	25	No warn
APDU#1	-2	16 - 2 = 14	25	No warn
APDU#1	-2	14 - 2 = 12	25	No warn
APDU#1	-2	12 - 2 = 10	25	No warn
APDU#2	+10	10 + 10 = 20	25	No warn

Table 3 - Abnormal working sequence; the attack detector raise up a warning

Input APDU	Ponder Value	Counter Value (old + ponder = new value)	Threshold	Warning Status
APDU#3	-4	20 - 4 = 16	25	No warn
APDU#1	-2	16 - 2 = 14	25	No warn
APDU#2	+10	14 + 10 = 24	25	No warn
APDU#3	-4	24 - 4 = 20	25	No warn
APDU#1	-2	20- 2 = 18	25	No warn
APDU#2	+10	18 + 10 = 28	25	Warning attack detected

Figure 2 shows in a detailed and schematic view the counter value updating according to the method of the present invention. More particularly a generic "input command X", before being executed, is processed by the ponder over 6 that detects the ponder value associated to the input command X through a look up table like the one shown in table 5. If the ponder over 6 detects, for example, that the command to be executed is the input command "i", it increments the counter value adding, to its actual value, the ponder value "Pi", where i represent all the possible input commands.As an alternative, in case of software implementation, the pondering phase may be obtained by a cascade of test instructions of the "IF" kind in a specific subroutine, thus assigning a predetermined ponder value according to the result of an IF test.
It's important to note that the ponder values may even be varied after the processing of an input command. In other words, the ponder values in the look up table or the predetermined ponder values in said subroutine might be changed dynamically to increase the reaction force of the token or card 1 against a reiterated attack.
The Counter 9 is provided to increment or decrement the stored counter value. Moreover, the counter 9 may be incremented by a predetermined or variable amount of integer values just according to the assigned ponder values.
The Threshold Reference 8 define a threshold value for the comparison; this threshold value may even be updated after receipt of a first warning signal, so that a further or second attack attempt may be detected more quickly. Finally, the Comparator 9 compare the counter value with the threshold level and rises up the output line for instance if the counter is minor than the threshold.
A possible simplified version of the inventive structure or procedure would require a simple counter keeping and storing a predetermined value that should be decremented according to the output of the ponder block 6 or subroutine.
When such a counter should reach a "0" value, the warning signal would be automatically generated.
A skilled in the art should appreciate that this possible simplified embodiment is just an alternative manner to realize the previously disclosed embodiment, since the final "0" value of the simplified and decremental counter may be considered corresponding to the reference threshold value and a comparison is considered performed just when the counter has reached the "0" value or an end or reset value.
In this respect, at the very beginning the counter is initialized with a suitable starting value obtained for example by experimental results on the typical working scenario.
The counter 9 can store the counter value in a non volatile memory portion of the card so to keep it even if a power loss occur and avoiding easy workaround based on power loss.
The attack detector parse the input commands (APDUs in the case of Smart Card) sent by the external word to the cryptographic token before they are elaborated by the microcontroller.
In particular the block 6 named Ponder Over analyze the input command and assign it a ponder value to be used to update the counter value. This value can be positive or negative (for instance in the disclosed alternative embodiment) according to the ponder strategy designed in the ponder over block 6 and so can increment or decrement the value of the counter.
In particular negative value are assigned to all the security enforcing operation which invoke a cryptographic algorithm. AS already mentioned, the ponder over can be based on a combinatory logic and implemented for example by means of look up tables or can be based on a more complex sequential logic network or algorithm.
In the case of SIM card where the attack detector can be use to counteract the SIM cloning increasing the protection of the network authentication algorithm against attacks, a negative value, opportunely selected on the base of experimental results can be assigned to the APDU RUN_GSM_Algorithm used to authenticate the card.
Suitable positive values have to be assigned to all the other input APDUs.
The counter value is constantly compared with a threshold value set up by the microcontroller. The threshold level is defined on the base of practical issues and may be minor of the counter starting value.
When the counter value goes under the threshold value the system attack detector rise up a potential attack warning to the system that become aware of a potential attack and set up a reaction. The reaction could be delay the next cryptographic calculation operation so to enlarge the time to conduct successfully an attack, for instance recalling a delay subroutine.
Figure 3 shows a flow chart representing the step of the method according to the present invention; in particular with reference S1 is indicated the reading of the input command i and with S2 the assigning of the corresponding ponder value.
The counter value is updated in S3 adding the ponder value of the input command i to its actual value; the new counter value is compared in C 1 with the Threshold reference causing the block of the IC Card if the Threshold is reached, as indicated in S5. Otherwise, if the Threshold is not reached, the input command can be executed in S4.
An alternative response could be that of confusing the attacker with a wrong output value obtained for instance through a random number generator.
Another possible alternative could be that of blocking the token or even a more complex reaction strategy.
If compared to the prior art, the present invention has the remarkable advantage to protect both the implementation and the logic of the algorithm.
Moreover the method is independent from the implementation and can be applied to all the algorithm and security procedures.
The invention offer an easy solution to SIM cloning problems of telecom operators which use old and breakable cryptographic algorithms and does not want to invest many resources in updating the network authentication systems with more resistant authentication cryptographic algorithms.
Advantageously, the present invention is based on a method for detecting and reacting against possible attacks considering a ponder value associated to each input command and a counter value associated to the sequence of execution of said input command. In this way a possible reaction is raised according to the sequence of execution of said input commands, taking into consideration a ponder value with a high value for input commands needing a high degree of security and a low ponder value, eventually a negative value, for input commands considered not dangerous for the IC Card security.
This method is dynamic because a reaction is raised not depending on the number of times an input command is executed but depending on the entire set execution of input commands performed during the activation of the IC Card. In this way the method prevents to raise an undesired reaction due, for example, to acceptable user errors and, at the same time, provides for a right reaction when the performed set of input commands is suspicious.
The invention does not limit the total number invocation of the security procedure preventing the crash of the security system even in abnormal abuse of such procedure; it is not based on timing measures and then is applicable to all simple systems that does not have an internal, coherent and continuous working reference of time like smart card.
Finally it can be partially implemented at the hardware level.

Claims

A method for detecting and reacting against possible attacks to security enforcing operation performed by a cryptographic token or an IC card (1) including the following steps:
- detecting (S1) an input command for said cryptographic token or IC card (1);

- assigning (S2) a ponder value to said input command;

- updating (S3) a counter value by adding or substracting said ponder value;

- comparing (C1) said counter value with a reference threshold;

- providing (S5) a warning signal output according to the result of said comparing step (C1);
characterized by the fact that said counter value changes dynamically depending on the sequence of execution of said input commands, said counter value being updated according to the ponder value associated to the executed input commands.
Method according to claim 1 characterized by the fact that said updating (S3) adds said ponder value to said counter value.
Method according to claim 2 characterized by the fact that said ponder value is a positive value.
Method according to claim 2 characterised by the fact that said ponder value is a negative value.
A method according to claim 1 characterized by the fact that said warning signal is issued by a rise up of an, output line if said counter value is minor than said reference threshold.
A method according to claim 1 characterized by the fact that said counter value is initialized with a suitable starting value obtained by experimental results on a typical working scenario of said cryptographic token or IC card (1).
A method according to claim 1 characterized by the fact that the input commands sent to said cryptographic token or IC card (1) are detected before they are elaborated by a microcontroller of said cryptographic token or IC card (1).
A method according to claim 1 characterized by the fact that said counter value is constantly compared with said reference threshold.
A method according to claim 1 characterized by the fact that said reference threshold is an end or reset value of said counter value.
A cryptographic token or IC card (1) including means for detecting and reacting against possible attacks to security enforcing operations and comprising a microcontroller (2) with associated or embedded memory portions, said means including an attack detector (3) comprising
- a ponder over (6) for assigning a ponder value to an input command of the cryptographic token or IC Card (1);

- a counter (7), connected to the output of said ponder over (6), for storing a counter value;

- a threshold reference (8), to define a reference threshold;

- a comparator (9), for comparing said counter value with said reference threshold and for providing an output warning signal according to the result of said comparator (9)
characterized by the fact that said counter (7) is connected to said ponder over (6) for updating said counter value by adding or substracting said ponder value depending on a sequence of execution of said input command.
A cryptographic token or IC card (1) according to claim 10, characterized by the fact that said output warning signal is applied to said microcontroller (2) to delay next cryptographic calculation operations thus confusing an attacker with wrong output value.
A cryptographic token or IC card (1) according to claim 10, characterized by the fact that said counter value is stored in a non volatile memory portion associated to said microcontroller (2).
A cryptographic token or IC card (1) according to claim 10, characterized by the fact that said counter (9) is initialized with a suitable starting value obtained by experimental results on a typical working scenario of the cryptographic token or IC Card (1).
A cryptographic token or IC card (1) according to claim 10, characterized by the fact that said ponder over (6) is a look up table.
A cryptographic token or IC card (1) according to claim 14, characterized by the fact that values of said look up table are updated dynamically after a processing of an input command.